One of the broadest discovery footprints in the directory, built on Tenable's scanning heritage and extended by the Vulcan Cyber acquisition. Validation is limited to security control status, not adversarial testing.
Tenable One aggregates an unusually wide range of asset types: traditional vulnerability management, web applications, cloud, operational technology, identity exposure, external attack surface and, more recently, artificial intelligence assets, plus third-party data connectors inherited from the Vulcan Cyber acquisition completed in February 2025.
Prioritisation is mature. Exposure View gives leadership a business-aligned score, Exposure Signals let an analyst query for specific toxic combinations, and attack path analysis models more than 150 techniques, though that last capability sits only in the Advanced package under the pricing introduced in April 2026.
Identity Exposure deserves separate mention: Active Directory and Entra ID weaknesses are where a large share of real attack paths run, and few exposure platforms treat identity as a first-class discovery domain. Scoping relies on an automatic asset criticality rating plus tags and business-aligned exposure cards, rather than a dedicated critical asset module.
Validation is partial. In June 2026 Tenable added continuous security control validation for all Tenable One customers, which checks whether existing defences already block an exposure and feeds that into prioritisation. That is evidence from control status, not attack simulation or exploitation; for adversarial testing Tenable still points to integrations with breach and attack simulation tools, meaning a second product for full stage four coverage.
Check in a demo: which capabilities fall in Foundation versus Advanced, because attack path analysis and the richer mobilisation workflow are the reason most buyers want the platform rather than the scanner.
Weak in one of these stages? The self-assessment tells you which stage to shop for first, and the directory shows who covers it.
Claim or correct this listing
Tell us what is wrong or what you want to confirm, and link a public source we can check. The owner reviews every claim. Nothing changes on the site until it has been reviewed, and a claim never changes a score or placement.
Get vendor updates monthly
One email a month: what changed in exposure management, which vendors moved, and one thing worth doing. No spam, unsubscribe any time.